We are Losing Sight of Why Protecting Privacy is Important for our Security

The UK Government’s Investigatory Powers Bill (IPB) is a new and controversial piece of proposed surveillance legislation. The recent review of the IPB by the UK Parliament (the “Second Reading”) offered the first opportunity for MPs to debate its main principles (see a guide to the passage of the Bill through Parliament here).

Representatives from industry, civil society, academia, the legal profession and other experts broadly agree that the Bill currently lacks adequate privacy protections.

Following publication of a draft IPB in November 2015, three Parliamentary Committees - on Science and Technology and Intelligence and Security as well as the Joint Committee on the Draft Investigatory Powers Bill - received oral and written submissions from a wide range of stakeholders, including many information and communication technology (ICT) companies that will be impacted by the Bill (see IHRB’s submissions here). Over 20 ICT companies and industry associations submitted written evidence on the draft IPB, publicly voicing concerns about vague language and lack of clarity with respect to key technical terms such as bulk collection, equipment interference and internet connection records.

Many stakeholders have raised concerns over the draft’s lack of privacy protections. They’ve questioned whether the intrusive new powers in the Bill and the resulting adverse impacts on privacy meet the test of being ‘legal, necessary, and proportionate,’ (the conditions necessary to justify intrusive powers). The report by the Intelligence and Security Committee, responsible for oversight of the UK intelligence agencies, was particularly vocal, commenting:

“It is the view of this Committee that privacy protections should form the backbone of the draft legislation, around which the exceptional powers are then built …. privacy considerations must form an integral part of the legislation, not merely an add-on.”

The committee recommended that the new legislation “should include a single additional Part that addresses privacy safeguards and clearly sets out universal privacy protections which apply across the full range of investigatory powers.”

In response to these concerns, the revised Bill now includes a chapter titled “General Privacy Protections” replacing the previous “General Protections”. It must be noted however that only the title has changed. The text in this chapter remains the same, a fact that has caused much outcry among civil society representatives and MPs who were expecting more detailed attention to privacy concerns. At the recent second reading of the Bill, former Deputy Prime Minister Nick Clegg MP commented that the Home Office was:

“institutionally insensitive to the importance that should be attached to privacy” and that “a department that cared about privacy would provide more than a one word response to the ISC”.

The UK government has the opportunity to show real leadership and put privacy at the core of this important legislation. A Bill with safeguards to ensure rights are not infringed in the pursuit of preventing and investigating criminal acts would be a much needed step forward. Instead, the Government’s current approach risks significantly strengthening state powers at the expense of privacy.

Unfortunately, the debates thus far have not adequately addressed why privacy is important, why it is an essential part of all our security, and why privacy protections should form the “backbone” of legislation, with investigatory powers built around it. During the Second Reading, the Scottish National Party MP Joanna Cherry commented:

“I want to challenge the premise that the more privacy we sacrifice, the more security we gain, because that is not backed up by the evidence.”

The supporting materials for the IPB, including the Guide to Powers and Privacy Safeguards present several case studies to justify why the intrusive powers sought are needed. These are based on genuine concerns – such as violent organised crime, attempted murder, child exploitation, and terrorists attempting to gain access to firearms. No one contends that authorities should be prevented from tackling such criminal behaviour. What is missing however is recognition of the other side of the argument, how privacy protections assist in preventing and solving crime and the risks to security if sufficient privacy protections are not in place. Perhaps case studies are needed to demonstrate this side of the argument as well.

For example, if people with information about criminal acts do not feel confident that their anonymity can be protected, or that communications might be accessed which leads to an identity being revealed, they may not come forward. According to the UK charity Crimestoppers, thanks to information provided anonymously, every eight days a person is charged with murder, around 14 people are arrested daily, and over £18 million of illegal drugs were seized in 2013-14. In addition, the UK government encourages people to report information about terrorism anonymously.

Equally important, digital privacy tools, often derided for helping criminals evade detection, also protect the identity of law enforcement officers fighting crime and military personnel overseas. Tools like Tor allow anonymous internet browsing by hiding IP addresses and avoiding “traffic analysis” which identifies who is talking with whom over a public network. Law enforcement or military personnel use Tor to hide their IP address when intelligence gathering on illegal websites or engaging in undercover operations.

The UK government is under pressure to pass the Bill quickly, before the “sunset clause” in the 2014 Data Retention and Investigatory Powers Act (DRIPA) which applies as of December this year, by which time some powers would be lost. But this is a complex piece of legislation. All Committees have said the Bill lacks the clarity essential for legislation of this nature, and that the Government needs to take sufficient time and care to address such concerns. They have rightly urged against rushing the Bill through Parliament. An open letter in The Guardian signed by 200 lawyers says the Bill fails to meet international standards. The view of some civil society groups, experts and MPs expressed in an open letter in the Telegraph newspaper, is that the Bill should be split, addressing those powers subject to the sunset clause first and taking more time over the rest. That is a wise suggestion.

The Bill passed its second reading in Parliament, and will next be considered by a Public Bill Committee, where it will be scrutinised line by line. This Committee will also accept written evidence and conduct oral evidence sessions with experts until the beginning of May.  Following this, British politicians must ensure that sufficient protections and safeguards are in place in this important piece of legislation so that privacy rights will continue to be protected for decades to come.